Monitoring method and device of operating system, vehicle and storage medium

Abstract

The invention discloses an operating system monitoring method and device, a vehicle and a storage medium, the method and device are applied to a vehicle domain controller, the vehicle domain controller is provided with a first operating system and a second operating system, and the method comprises the steps that the first operating system sends a dog feeding source signal to the second operating system through a hardware transmission interface; the second operating system determines a first dog feeding signal according to the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface; and the first operating system monitors the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal. By means of the method, the problem that the dog feeding source signal and the first dog feeding signal are tampered in the shared memory is avoided, meanwhile, errors caused when the state of the second operating system is determined independently through the first dog feeding signal are avoided, and then the monitoring accuracy of the state of the second operating system is improved.

Description

Technical Field

[0001] The present application relates to the technical field of domain controllers, and more specifically, to a monitoring method, device, vehicle and storage medium for an operating system. Background Art

[0002] A multi-core heterogeneous chip includes multiple operating systems for implementing different functions. Therefore, whether the state of the operating system is normal or not determines whether the function can be implemented normally. Summary of the invention

[0003] In view of the above problems, the present application proposes a monitoring method, device, vehicle and storage medium for an operating system.

[0004] In a first aspect, an embodiment of the present application provides a method for monitoring an operating system, which is applied to a vehicle domain controller, wherein the vehicle domain controller is deployed with a first operating system and a second operating system, and the method includes: the first operating system sends a dog feeding source signal to the second operating system through a hardware transmission interface; the second operating system determines a first dog feeding signal based on the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface; the first operating system monitors the status of the second operating system based on the dog feeding source signal and the received first dog feeding signal.

[0005] In a second aspect, an embodiment of the present application provides a monitoring device for an operating system, the device comprising: a dog feeding source signal sending module, used for the first operating system to send the dog feeding source signal to the second operating system through a hardware transmission interface; a first dog feeding signal sending module, used for the second operating system to determine a first dog feeding signal based on the received dog feeding source signal, and send the first dog feeding signal to the first operating system through the hardware transmission interface; a monitoring module, used for the first operating system to monitor the status of the second operating system based on the dog feeding source signal and the received first dog feeding signal.

[0006] In a third aspect, an embodiment of the present application provides a vehicle, comprising: one or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the operating system monitoring method provided in the first aspect above.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the operating system monitoring method provided in the first aspect above.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a program code, and the program code can be called by a processor to execute the operating system monitoring method provided in the first aspect above.

[0009] The solution provided by the present application directly sends the dog feeding source signal and obtains the first dog feeding signal of the second operating system through the first operating system and utilizes the hardware transmission interface, thereby avoiding the problem of the dog feeding source signal and the first dog feeding signal being tampered with, and jointly determines the state of the second operating system based on the dog feeding source signal and the first dog feeding signal, further avoiding the error caused by determining the state of the second operating system solely through the first dog feeding signal, thereby improving the accuracy of monitoring the state of the second operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 A schematic diagram of a monitoring method for an operating system in the related art is shown.

[0012] Figure 2 A flow chart of a method for monitoring an operating system provided in an embodiment of the present application is shown.

[0013] Figure 3 A flow chart of a method for monitoring an operating system provided in another embodiment of the present application is shown.

[0014] Figure 4 A flow chart of a method for monitoring an operating system provided in yet another embodiment of the present application is shown.

[0015] Figure 5 A data interaction diagram of the operating system monitoring method provided in an embodiment of the present application is shown.

[0016] Figure 6 A data interaction diagram for monitoring the operating system 1 provided in an embodiment of the present application is shown.

[0017] Figure 7 A schematic diagram of a heartbeat monitoring mechanism provided in an embodiment of the present application is shown.

[0018] Figure 8 A data interaction diagram for monitoring operating system 2 and operating system 3 provided in an embodiment of the present application is shown.

[0019] Fig. 9 A structural block diagram of an operating system monitoring device provided in an embodiment of the present application is shown.

[0020] Fig.10 A structural block diagram of a vehicle provided in an embodiment of the present application for executing a monitoring method of an operating system according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0022] See also Figure 1 , Figure 1 A schematic diagram of a monitoring method for an operating system in the related art is shown. Figure 1 In the embodiment, the security level of the first operating system is higher than or equal to the security level of the second operating system and the security level of the third operating system. The first operating system may be a real-time operating system of a higher level, and the security level of the real-time operating system is ASIL D or ASILC. The second operating system and the third operating system may be real-time operating systems of a lower level or virtual machine Linux systems. Among them, the security level corresponding to the real-time operating system of a lower level may be ASIL B or ASIL A or quality management (Quality Management, QM), QM means that as long as the standard quality management process is followed, no additional safety measures are required. The Linux system is an open source system, therefore, the security level of the Linux system is not high.

[0023] For monitoring of the first operating system, a watchdog management module (Watchdog Manager, WdgMgr) can be connected, and the watchdog module can be driven by a watchdog driver module (Watchdog Driver, Wdg Dvr), and the first operating system can be monitored by the watchdog module. The monitoring method can be to regularly obtain the heartbeat data of the first operating system for monitoring, or to regularly obtain the bus data of the first operating system for monitoring, and the monitoring method of the first operating system is not limited here.

[0024] For monitoring the second operating system and the third operating system, the data of the first operating system and the data of the second operating system and the third operating system can be written into a shared memory, so that the first operating system can monitor the second operating system and the third operating system. The number of shared memories can be one or more. When the number of shared memories is one, the data in the first operating system, the second operating system and the third operating system are all written into the same shared memory. When the number of shared memories is multiple, it is determined that the data of the first operating system and the second operating system are written into one of the shared memories, and the data of the first operating system and the third operating system are written into another shared memory. The number of shared memories is not specifically limited here.

[0025] The monitoring of software information in the Linux system is performed by the Platform Health Manager module (PHM). When the first operating system and the second operating system are not Linux systems, the first operating system and the second operating system both monitor the software information of each application software in the operating system through the Wdg Mgr in their respective operating systems, and upload the monitored information to the shared memory through Wdg Mgr. When the third operating system is a Linux system, the software information of the application software in the third operating system is monitored and collected through PHM, and the collected software information is uploaded to the shared memory. So that the first operating system monitors the second operating system and the third operating system according to the software data in the shared memory. Since the amount of data in the shared memory is large, and the shared memory is open to more than one operating system, it is easy for other operating systems to tamper with the data, resulting in low accuracy in monitoring the operating system.

[0026] The software information includes but is not limited to the software operation cycle, application software process information, and software execution time. Wdg Mgr includes an alive monitoring module, a logical monitoring module, and a deadline monitoring module. The alive monitoring module is used to monitor and obtain the operation cycle of each application software in the operating system, the logical monitoring module is used to monitor and obtain the process information of each application software in the operating system, and the deadline monitoring module is used to monitor and obtain the execution time of each application software in the operating system.

[0027] In response to the technical problems raised by the background technology, the inventors proposed a monitoring method, device, vehicle and storage medium for an operating system, which directly sends a dog feeding source signal and obtains a first dog feeding signal of a second operating system through a first operating system and a hardware transmission interface, thereby avoiding the problem of the dog feeding source signal and the first dog feeding signal being tampered with in a shared memory, and jointly determining the state of the second operating system based on the dog feeding source signal and the first dog feeding signal, further avoiding the error caused by determining the state of the second operating system solely through the first dog feeding signal, thereby improving the accuracy of monitoring the state of the second operating system.

[0028] See also Figure 2 , Figure 2 FIG. 1 is a flow chart of a method for monitoring an operating system provided by an embodiment of the present application. In a specific embodiment, the method for monitoring an operating system is applied to a system deployed with Fig. 9 The vehicle domain controller of the operating system monitoring device 200 and the vehicle equipped with the operating system monitoring device 200 are shown. A first operating system and a second operating system are deployed in the vehicle domain controller.

[0029] The following will focus on Figure 2 The process shown is described in detail. The operating system monitoring method is applied to a vehicle domain controller, and the vehicle domain controller is deployed with a first operating system and a second operating system. Specifically, the following steps may be included:

[0030] Step S110: the first operating system sends a dog feeding source signal to the second operating system through a hardware transmission interface.

[0031] Among them, an operating system (OS) is a program built into a hardware electronic device, which is used to cooperate with various hardware of the electronic device to interact with the user.

[0032] Furthermore, the hardware transmission interface is a hardware interface for data interaction and connection to external devices. In the embodiment of the present application, the first operating system and the second operating system perform data interaction via the hardware transmission interface, which can realize direct interaction between the data in the first operating system and the data in the second operating system, and avoid the problem of tampering, loss and data delay of the interactive data.

[0033] The dog-feeding source signal may be data predetermined by the first operating system, or data obtained according to a preset mechanism. The preset mechanism includes but is not limited to a preset algorithm. The dog-feeding source signal may also be heartbeat data of the first operating system, or bus data of the first operating system. The dog-feeding source signal is not specifically limited here.

[0034] It should be noted that in order to further ensure the accuracy of monitoring, the current dog feeding source signal should be different from other dog feeding source signals. When using the preset mechanism to determine the dog feeding source signal, the control data corresponding to the previous time period can be combined to generate control data that is different from the control data of other time periods.

[0035] In this embodiment, the first operating system simulates a watchdog system with a monitoring function, and sends the dog feeding source signal to the second operating system through a hardware transmission interface. The watchdog system refers to a system that can monitor other operating systems based on the dog feeding data obtained periodically. Directly transmitting data to the second operating system ensures the validity of the dog feeding source signal and avoids the problem of the dog feeding source signal being tampered with. Moreover, using the hardware transmission interface for transmission can improve the transmission efficiency of the dog feeding source signal.

[0036] Step S120: the second operating system determines a first dog feeding signal according to the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface.

[0037] Among them, the first dog-feeding signal can be data used to characterize the current state of the second operating system. The first dog-feeding signal can also be the heartbeat data of the second operating system, or it can be the bus data of the second operating system. It should be noted that the first dog-feeding signal is data uploaded after the second operating system receives the dog-feeding source signal, that is, the first dog-feeding signal can be obtained by the second operating system according to a preset algorithm and the dog-feeding source signal after receiving the dog-feeding source signal. The first dog-feeding signal and the generation method or acquisition method of the first dog-feeding signal are not specifically limited here.

[0038] In this embodiment, the second operating system uses the hardware transmission interface to feed back the first dog feeding signal to the first operating system, so that the first operating system monitors the state of the second operating system according to the first dog feeding signal.

[0039] Step S130: the first operating system monitors the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal.

[0040] In an embodiment of the present application, the monitoring method may be to first determine whether the dog feeding source signal is the same or opposite to the first dog feeding signal, or whether a preset matching condition is met. If so, the state of the second operating system is determined to be a normal state. If not, the second operating system is determined to be an abnormal state. When the second operating system is determined to be abnormal, the first operating system may be used to feedback to the user that the second operating system is in an abnormal state, so that the user may perform abnormal processing on the second operating system in a timely manner, or the first operating system may directly perform abnormal processing on the second operating system. Exception processing may be a reset processing of the second operating system to restore the second operating system to an initial state or a preset state, and the exception processing may also be a restart processing of the second operating system to initialize the second operating system. Exception processing may also be a reset processing or a restart processing of the main control chip of the vehicle domain controller. The specific exception processing method may be determined according to the abnormal degree of the second operating system, which is not specifically limited here. After the second operating system is subjected to abnormal processing, the first operating system re-determines the dog feeding source signal, and receives again the first dog feeding signal fed back by the second operating system based on the re-determined dog feeding source signal to monitor the state of the second operating system after the abnormal processing.

[0041] It is understandable that the security level of the first operating system should be higher than or equal to the security level of the second operating system to ensure the accuracy of the monitoring results. The security level of the operating system can be determined according to the security level assessment regulations or can be set according to user needs. The method for determining the security level of the first operating system and the security level of the second operating system is not specifically limited here.

[0042] The operating system monitoring method provided in the embodiment of the present application directly sends a dog feeding source signal and obtains the first dog feeding signal of the second operating system through the first operating system and utilizes the hardware transmission interface, thereby avoiding the problem of the dog feeding source signal and the first dog feeding signal being tampered with in the shared memory, and jointly determines the state of the second operating system based on the dog feeding source signal and the first dog feeding signal, further avoiding the error caused by determining the state of the second operating system solely through the first dog feeding signal, thereby improving the accuracy of monitoring the state of the second operating system.

[0043] See also Figure 3 , Figure 3 A schematic diagram of a process flow of an operating system monitoring method provided by another embodiment of the present application is shown. Figure 3 The process shown is described in detail, and the monitoring method of the operating system may specifically include the following steps:

[0044] Step S210: the first operating system sends a dog feeding source signal to the second operating system through a hardware transmission interface.

[0045] Step S220: the second operating system determines a first dog feeding signal according to the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface.

[0046] For detailed description of steps S210 to S220 , please refer to steps S110 to S120 in the aforementioned embodiment, which will not be repeated here.

[0047] Step S230: the first operating system obtains a target time period in which the time for sending the dog feeding source signal lies, wherein the target time period includes a target window period, and the target window period is a period within the target time period in which data is allowed to be received.

[0048] Among them, the time period refers to the period after the first operating system sends the dog feeding source signal to the second operating system, receives the first dog feeding signal uploaded by the second operating system, and before the first operating system sends the dog feeding source signal to the second operating system next time. In this embodiment, the time period includes an open window period and a closed window period. The open window period is the time when data acquisition is allowed, and the closed window period is the period for data transmission. During the closed window period, in order to ensure that the data sent to the second operating system is not affected, data uploading is not allowed during this period. If data uploaded by a certain operating system is acquired during the closed window period, it can be determined that the state of the operating system is an abnormal state.

[0049] Step S240: the first operating system determines the reception time of the first dog feeding signal according to the first dog feeding signal.

[0050] Step S250: If the receiving time is within the target window period, based on a preset matching condition, the first operating system monitors the state of the second operating system according to the dog feeding source signal and the first dog feeding signal.

[0051] The receiving time may be obtained from the first dog feeding signal or from an upload communication channel of the first dog feeding signal. The method for obtaining the upload time is not specifically limited herein.

[0052] In this embodiment, when the upload time of the first dog feeding signal is within the target window period, it indicates that the upload time of the first dog feeding signal is normal, but it does not mean that the first dog feeding signal satisfies the preset matching condition. Therefore, it is necessary to further monitor and process the second operation according to the preset matching condition and the first dog feeding signal whose upload time is within the target window period.

[0053] It is understandable that the preset matching condition can be the same, that is, the dog feeding source signal is the same as the first dog feeding signal. The preset matching condition can also be a flip match, that is, the dog feeding source signal and the first dog feeding signal can reach consistency through a specific flipping method. The preset matching condition can also be opposite, that is, the dog feeding source signal and the first dog feeding signal are opposite data. The preset matching condition is not specifically limited here.

[0054] In some embodiments, if the receiving time is within the target window period, and the preset matching condition is satisfied between the dog feeding source signal and the first dog feeding signal, the first operating system determines that the state of the second operating system is a normal state; if the preset matching condition is not satisfied between the dog feeding source signal and the first dog feeding signal, the first operating system determines that the state of the second operating system is an abnormal state; the first operating system performs exception processing on the second operating system in an abnormal state.

[0055] In this embodiment, the exception handling may be a reset process for the second operating system, a restart process for the second operating system, or a reset process or a restart process for the main control chip of the vehicle domain controller, and the exception handling is not specifically limited here. It should be noted that the reset process refers to the process of restoring the main control chip of the operating system or the domain controller to the initial state or a specified preset state, and the restart process refers to the process of restarting the main control chip of the operating system or the domain controller.

[0056] In an optional embodiment, if the preset matching condition is not satisfied between the dog feeding source signal and the first dog feeding signal, the first operating system determines that the state of the second operating system is an abnormal state, including: if the level state corresponding to the dog feeding source signal and the level state corresponding to the first dog feeding signal do not satisfy the preset matching condition, determining that the state of the second operating system is an abnormal state.

[0057] Among them, the level state includes high level, low level, high and low level frequency and duty cycle of high and low level. High level can represent logic "1" or "true", while low level can represent logic "0" or "false". The level state can also reflect the number of times the first dog-feeding signal is at high level and low level within a unit time. The number of changes in a cycle can be obtained according to the number of times the first dog-feeding signal changes from high level to low level and then back to high level, that is, the frequency of the hardware transmission interface. The duty cycle refers to the proportion of the high level time in the first dog-feeding signal to the total time.

[0058] Furthermore, the preset matching condition between the dog feeding source signal and the first dog feeding signal can be satisfied by that the level state and the duty cycle in the dog feeding source signal are the same as the level state and the duty cycle in the first dog feeding signal, or the frequency and the duty cycle in the dog feeding source signal are the same as the frequency and the duty cycle in the first dog feeding signal, or the frequency in the dog feeding source signal is the same as the frequency in the first dog feeding signal, and the duty cycle in the dog feeding source signal is opposite to the duty cycle in the first dog feeding signal. At this time, no specific limitation is imposed on the manner in which the preset matching condition is satisfied between the dog feeding source signal and the first dog feeding signal.

[0059] In this embodiment, when the upload time of the first dog feeding signal is within the target window period, and the dog feeding source signal and the first dog feeding signal meet the preset matching condition, the state of the second operating system is determined to be normal. If the upload time of the first dog feeding signal is within the target window period, but the dog feeding source signal and the first dog feeding signal do not meet the preset matching condition, it is impossible to determine whether the first dog feeding signal is the data fed back based on the dog feeding source signal this time, and it is also impossible to determine whether the first dog feeding signal has completely received the dog feeding source signal. At this time, it is determined that the state of the second operating system is abnormal. Through multiple monitoring based on the upload time and the preset matching condition, the second operating system can be monitored more accurately to ensure the monitoring quality.

[0060] In another embodiment, the window period is only applicable to high-level monitoring mechanisms with window periods. For low-level monitoring mechanisms, the received data can be directly used for monitoring. It should be noted that low-level monitoring mechanisms are applicable to functional safety requirements of functional safety ASIL B and below, and high-level monitoring mechanisms are applicable to functional safety requirements of ASIL C and above. In addition, the low-level monitoring mechanism does not require the first operating system to send data to the second operating system. The data directly received from the second operating system is considered to have heartbeat information, which increases the data interaction between the first operating system and the second operating system to improve the diagnostic coverage and reduce the failure rate.

[0061] Step S260: If the upload time is not within the target window period, the first operating system determines that the state of the second operating system is an abnormal state, and performs exception processing on the second operating system in the abnormal state.

[0062] Among them, the receiving time is not within the target window period can refer to the upload time is within the target window period in the target time period, the target window period is the period for the first operating system to send data to the second operating system, and data reception is not allowed at this time. Therefore, when the upload time is within the target window period, it can be determined that the second operating system is in an abnormal state. The upload time is not within the target window period and can also refer to the target window period that is not within the target time period, that is, the upload time can be a window period or a window period in other time periods. At this time, the second operating system cannot feedback data in time, so the state of the second operating system is also abnormal.

[0063] In some embodiments, the first operating system sends a reset instruction to the second operating system; the first operating system counts a target reset processing number of the second operating system according to the reset processing information sent by the second operating system after performing a reset processing based on the reset instruction, and obtains the target reset processing number, wherein the target reset processing number represents the number of consecutive reset processing times of the second operating system; when the target reset processing number is equal to the preset reset number, the first operating system sends a reset request to the main control chip corresponding to the vehicle domain controller, so that the main control chip is reset according to the reset request.

[0064] The main control chip refers to the "brain" of the vehicle domain controller, which is responsible for the control function of the vehicle domain controller. The main control chip of the vehicle domain controller can be a system on chip (SoC) chip or a microcontroller unit (MCU). The main control chip of the vehicle domain controller is not specifically limited here.

[0065] In this embodiment, when the state of the second operating system is an abnormal state, the first operating system will first send a reset instruction to the second operating system to reset the second operating system, and then restore the second operating system to an initial state or a preset state to resolve the abnormality of the second operating system. When the number of consecutive resets exceeds the preset number of resets, it is determined that the abnormality of the second operating system cannot be resolved by resetting the second operating system, that is, it is possible that the abnormality of other operating systems causes the second operating system to receive abnormal data, thereby causing the abnormality of the second operating system. At this time, the vehicle domain controller can be restored to the initial state or the preset state by resetting the main control chip of the vehicle domain controller, thereby resolving the abnormality of the second operating system.

[0066] The monitoring method of the operating system provided in the embodiment of the present application directly sends the dog feeding source signal and obtains the first dog feeding signal of the second operating system through the first operating system and the hardware transmission interface, thereby avoiding the problem of the dog feeding source signal and the first dog feeding signal being tampered with. First, it is determined whether it is within the window period allowing data reception according to the reception time of the first dog feeding signal. If it is within the window period, the state of the second operating system is monitored according to the dog feeding source signal, the first dog feeding signal and the preset matching condition. When the dog feeding source signal and the first dog feeding signal meet the preset matching condition, it is determined that the state of the second operating system is normal. If the dog feeding source signal and the first dog feeding signal do not meet the preset matching condition, it is determined that the state of the second operating system is abnormal, and the second operating system is subjected to abnormal processing. If the reception time is within the closed window period, it is determined that the state of the second operating system is abnormal, and the second operating system is subjected to abnormal processing.

[0067] See also Figure 4 , Figure 4 A schematic diagram of a process flow of an operating system monitoring method provided by another embodiment of the present application is shown. Figure 4 The process shown is described in detail, the vehicle domain controller is connected to a target watchdog module, and the monitoring method of the operating system may specifically include the following steps:

[0068] Step S310: the target watchdog module obtains a second dog feeding signal sent by the first operating system to the target watchdog module within a current time period.

[0069] The target watchdog module may be a hardware module with a timer circuit for monitoring the running status of the operating system in the vehicle domain controller, or a software module with a watchdog software system deployed in the vehicle, and the watchdog software system includes a software timer. The target watchdog is not specifically limited here. The target watchdog module periodically checks the status of the operating system, and once an abnormality or error is found, it triggers a reset program to restart the operating system.

[0070] It is understandable that the second dog-feeding signal is used to characterize the system state of the first operating system, so that the target watchdog module can detect the state of the first operating system according to the second dog-feeding signal. The second dog-feeding signal can be bus data of the first operating system or heartbeat data of the first operating system, and the second dog-feeding signal is not specifically limited here.

[0071] In an embodiment of the present application, the target watchdog module may obtain the second dog feeding signal through a communication channel between the target watchdog module and the first operating system, or through a connection channel between the vehicle domain controller and the target watchdog module. The method for obtaining the second dog feeding signal is not specifically limited herein.

[0072] Step S320: If the acquisition time corresponding to the second dog feeding signal is not within the window period of the current time period, the target watchdog module determines that the state of the first operating system is an abnormal state, and performs exception processing on the first operating system in the abnormal state.

[0073] Among them, the exception handling can be sending a reset request to the first operating system so that the first operating system performs a reset process. The exception handling can also be counting the number of resets of the first operating system. When the number of resets reaches the reset number threshold, a reset request will be sent to the main control chip of the vehicle domain controller, so that the main control chip performs a reset process according to the reset request, so as to initialize the first operating system which is currently in an abnormal state, and then repair the abnormal situation of the first operating system. The exception handling can refer to the specific processing method in the aforementioned embodiment, and will not be specifically limited here.

[0074] In this embodiment, the acquisition time of the second dog-feeding signal can be during the window period in the current time period, or can be during other time periods. At this time, it is determined that the upload time of the second dog-feeding signal is abnormal, and the state of the first operating system is further determined to be an abnormal state. The first operating system in the abnormal state is subjected to exception processing to restore the state of the first operating system to a normal state.

[0075] Step S330: If the acquisition time corresponding to the second watchdog signal is within the window period of the current time period, the target watchdog module determines that the state of the first operating system is normal, so that the first operating system in the normal state can send the watchdog source signal to the second operating system through the hardware transmission interface.

[0076] In this embodiment, the window period of the current time cycle is the period in the current time cycle when data acquisition is allowed. When the target watchdog module acquires the second dog feeding signal during the window period of the current time cycle, the time when the first operating system uploads the second dog feeding signal is determined to be the time when data uploading is allowed, and it is further determined that the state of the first operating system is normal.

[0077] Step S340: the first operating system sends the dog feeding source signal to the second operating system through the hardware transmission interface.

[0078] Step S350: the second operating system determines a first dog feeding signal according to the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface.

[0079] Step S360: the first operating system monitors the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal.

[0080] For detailed description of steps S340 to S360 , please refer to steps S110 to S130 in the aforementioned embodiment, which will not be repeated here.

[0081] The operating system monitoring method provided in the embodiment of the present application first monitors the state of the first operating system through the target watchdog module. When the state of the first operating system is normal, the first operating system directly sends a watchdog source signal and obtains the first watchdog signal of the second operating system by using the hardware transmission interface, and jointly determines the state of the second operating system based on the watchdog source signal and the first watchdog signal, thereby avoiding the monitoring error of the second operating system caused by the abnormal state of the first operating system, and also avoiding the error caused by determining the state of the second operating system through the first watchdog signal alone, thereby improving the accuracy of monitoring the state of the second operating system.

[0082] For example, let's use heartbeat data to monitor the operating system. Figure 5-6 , Figure 5 A data interaction diagram of the operating system monitoring method provided in an embodiment of the present application is shown. Figure 6 A data interaction diagram for monitoring the operating system 1 provided by an embodiment of the present application is shown. The operating system 1 initializes the watchdog module, turns on the external watchdog function, and regularly sends corresponding dog feeding data (heartbeat data) to the watchdog module. The dog feeding operation is completed by the Wdg Mgr in the operating system 1. If the dog feeding fails, the watchdog module sends a reset request to the main control chip where the operating system 1 is located through the hardware transmission interface to control the main control chip to reset.

[0083] The Wdg Mgr in the operating system 1 is also responsible for monitoring whether the heartbeat data of the Wdg Mgr in the operating system 2 and the PHM in the operating system 3 are normal through the hardware transmission interface.

[0084] Heartbeat data monitoring mechanism such as Figure 7As shown. A timer is set inside Wdg Mgr, and the period from 0 to A is set as the window-off period, and the period from A to A+B is set as the window-on period. This cycle continues. During the window-off period, if the dog-feeding signal (i.e., heartbeat data) received from operating system 2 is not at a low level, it is considered that the heartbeat of operating system 2 is abnormal. During the window-off period, Wdg Mgr in operating system 1 will specify a frequency and duty cycle of the next dog-feeding signal to operating system 2 through the dog-feeding source data, where the frequency and duty cycle of each transmission are generated by a certain algorithm or mechanism to ensure that the frequency and duty cycle are inconsistent each time in order to meet higher security level requirements.

[0085] like Figure 8 As shown, during the window period, if the frequency and duty cycle of the dog feeding data received from operating system 2 do not meet the preset matching conditions with the dog feeding source data specified by Wdg Mgr in operating system 1, it is considered that the heartbeat of operating system 2 is abnormal. After Wdg Mgr in operating system 1 detects the abnormality of operating system 2, it will control the operating system 2 to restart or reset, and then restart the monitoring of operating system 2. If the operating system 2 fails to perform the dog feeding operation normally after restarting or resetting for more than the specified number of times, that is, the dog feeding data fed back by operating system 2 does not meet the preset matching conditions with the dog feeding source data of operating system 1, it is determined whether it is necessary to reset the main control chip to recover the fault according to the current scenario.

[0086] For example, if operating system 2 is the air conditioning operating system on the vehicle, the impact on the vehicle's driving is not significant, and the main control chip where the operating system is located can be processed. If operating system 2 is the vehicle's driving management system, restarting the main control chip where the driving management system is located has a great impact on the vehicle's driving, so only the operating system is reset.

[0087] The monitoring of operating system 3 by operating system 1 can refer to the monitoring of operating system 2 by operating system 1, which will not be repeated here.

[0088] See also Fig. 9 , which shows a structural block diagram of a monitoring device 200 for an operating system provided in an embodiment of the present application. The monitoring device 200 for the operating system is applied to a vehicle, and the monitoring device 200 for the operating system includes: a dog feeding source signal sending module 210, which is used for the first operating system to send the dog feeding source signal to the second operating system through a hardware transmission interface; a first dog feeding signal sending module 220, which is used for the second operating system to determine the first dog feeding signal according to the received dog feeding source signal, and send the first dog feeding signal to the first operating system through the hardware transmission interface; a monitoring module 230, which is used for the first operating system to monitor the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal.

[0089] In some embodiments of the present application, the monitoring module 230 includes: a target time period acquisition submodule, used for the first operating system, to obtain the target time period in which the time of sending the dog feeding source signal is located, the target time period includes a target window period, and the target window period is a period within the target time period during which data reception is allowed; a receiving time determination submodule, used for the first operating system, to determine the receiving time of the first dog feeding signal according to the first dog feeding signal; a monitoring submodule, used for, if the receiving time is within the target window period, based on a preset matching condition, the first operating system monitors the state of the second operating system according to the dog feeding source signal and the first dog feeding signal; an abnormal state determination submodule, used for, if the upload time is not within the target window period, the first operating system determines that the state of the second operating system is an abnormal state, and performs exception processing on the second operating system in the abnormal state.

[0090] In some embodiments of the present application, the monitoring submodule includes: a normal state determination unit, which is used for the first operating system to determine that the state of the second operating system is a normal state if the receiving time is within the target window period and the preset matching condition is satisfied between the dog feeding source signal and the first dog feeding signal; an abnormal state determination unit, which is used for the first operating system to determine that the state of the second operating system is an abnormal state if the preset matching condition is not satisfied between the dog feeding source signal and the first dog feeding signal; and an exception handling unit, which is used for the first operating system to perform exception handling on the second operating system in an abnormal state.

[0091] In some embodiments of the present application, the abnormal state determination unit includes: an abnormal state determination subunit, which is used to determine that the state of the second operating system is an abnormal state if the level state corresponding to the dog feeding source signal and the level state corresponding to the first dog feeding signal do not meet the preset matching condition.

[0092] In some embodiments of the present application, the exception handling submodule includes: a reset instruction sending unit, used for the first operating system, to send a reset instruction to the second operating system; a counting unit, used for the first operating system, to count the target reset processing times of the second operating system according to the reset processing information sent by the second operating system after the reset processing based on the reset instruction, to obtain the target reset processing times, wherein the target reset processing times represent the number of consecutive reset processing times of the second operating system; a main control chip reset unit, used for the first operating system to send a reset request to the main control chip corresponding to the vehicle domain controller when the target reset processing times is equal to the preset reset times, so that the main control chip is reset according to the reset request.

[0093] In some embodiments of the present application, the operating system monitoring device 200 further includes: a dog feeding source signal determination module, which is used for the first operating system to determine the dog feeding source signal according to a preset mechanism.

[0094] In some embodiments of the present application, the vehicle domain controller is connected to a target watchdog module, and the target watchdog module communicates with the first operating system, and the operating system monitoring device 200 also includes: a second dog feeding signal acquisition module, used for the target watchdog module to acquire the second dog feeding signal sent by the first operating system to the target watchdog module within the current time period; an abnormal state determination module for the first operating system, used for if the acquisition time corresponding to the second dog feeding signal is not within the window period of the current time period, the target watchdog module determines that the state of the first operating system is an abnormal state, and performs exception processing on the first operating system in the abnormal state; a normal state determination module for the first operating system, used for if the acquisition time corresponding to the second dog feeding signal is within the window period of the current time period, the target watchdog module determines that the state of the first operating system is a normal state, so that the first operating system in a normal state can send the dog feeding source signal to the second operating system through the hardware transmission interface.

[0095] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0096] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0097] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0098] Please refer to Fig.10 , which shows a structural block diagram of a vehicle provided by an embodiment of the present application. The vehicle 100 in the present application may include one or more of the following components: a processor 110, a memory 120, and one or more applications, wherein the one or more applications may be stored in the memory 120 and configured to be executed by one or more processors 110, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0099] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire vehicle 100, and executes various functions and processes data of the vehicle 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0100] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the vehicle 100 during use (such as a phone book, audio and video data, chat record data), etc.

[0101] A computer-readable storage medium is also provided in an embodiment of the present application. A program code is stored in the computer-readable storage medium. The program code can be called by a processor to execute the method described in the above method embodiment.

[0102] The computer-readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium includes a non-transitory computer-readable storage medium. The computer-readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code can be compressed, for example, in an appropriate form.

[0103] A computer program product is also provided in an embodiment of the present application. The computer program product includes program code, and when the program code is executed by a processor, the method described in the above method embodiment is implemented.

[0104] In summary, the solution provided by the present application directly sends the dog feeding source signal and obtains the first dog feeding signal of the second operating system through the first operating system and utilizes the hardware transmission interface, thereby avoiding the problem of the dog feeding source signal and the first dog feeding signal being tampered with in the shared memory, and jointly determines the state of the second operating system based on the dog feeding source signal and the first dog feeding signal, further avoiding the error caused by determining the state of the second operating system solely through the first dog feeding signal, thereby improving the accuracy of monitoring the state of the second operating system.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for monitoring an operating system, characterized in that: Applied to a vehicle domain controller, the vehicle domain controller is deployed with a first operating system and a second operating system, the method includes: The first operating system sends the dog feeding source signal to the second operating system through the hardware transmission interface; The second operating system determines a first dog feeding signal according to the received dog feeding source signal, and sends the first dog feeding signal to the first operating system through the hardware transmission interface; The first operating system monitors the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal.

2. The method according to claim 1, characterized in that The first operating system monitors the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal, including: The first operating system obtains a target time period in which the time of sending the dog feeding source signal is located, wherein the target time period includes a target window period, and the target window period is a period within the target time period in which data is allowed to be received; The first operating system determines a reception time of the first dog feeding signal according to the first dog feeding signal; If the receiving time is within the target window period, based on a preset matching condition, the first operating system monitors the state of the second operating system according to the dog feeding source signal and the first dog feeding signal; If the upload time is not within the target window period, the first operating system determines that the state of the second operating system is an abnormal state, and performs exception processing on the second operating system in the abnormal state.

3. The method according to claim 2, characterized in that If the receiving time is within the target window period, based on a preset matching condition, the first operating system monitors the state of the second operating system according to the dog feeding source signal and the first dog feeding signal, including: If the receiving time is within the target windowing period, and the dog feeding source signal and the first dog feeding signal satisfy the preset matching condition, the first operating system determines that the state of the second operating system is a normal state; If the dog feeding source signal and the first dog feeding signal do not satisfy the preset matching condition, the first operating system determines that the state of the second operating system is an abnormal state; The first operating system performs exception processing on the second operating system that is in an abnormal state.

4. The method according to claim 3, characterized in that If the dog feeding source signal and the first dog feeding signal do not satisfy the preset matching condition, the first operating system determines that the state of the second operating system is an abnormal state, including: If the level state corresponding to the dog feeding source signal and the level state corresponding to the first dog feeding signal do not satisfy the preset matching condition, it is determined that the state of the second operating system is an abnormal state.

5. The method according to claim 3, characterized in that The first operating system performs exception processing on the second operating system in an abnormal state, including: The first operating system sends a reset instruction to the second operating system; The first operating system, according to the reset processing information sent by the second operating system after the second operating system performs the reset processing based on the reset instruction, counts the target reset processing number of the second operating system to obtain the target reset processing number, wherein the target reset processing number represents the number of consecutive reset processing times of the second operating system; When the target reset processing times is equal to the preset reset times, the first operating system sends a reset request to the main control chip corresponding to the vehicle domain controller, so that the main control chip is reset according to the reset request.

6. The method according to claim 1, characterized in that Before the first operating system sends the dog feeding source signal to the second operating system through the hardware transmission interface, the method further includes: The first operating system determines the dog feeding source signal according to a preset mechanism.

7. The method according to any one of claims 1 to 6, characterized in that: The vehicle domain controller is connected to a target watchdog module, and the target watchdog module communicates with the first operating system. Before the first operating system sends a watchdog source signal to the second operating system through a hardware transmission interface, the method further includes: The target watchdog module obtains a second dog feeding signal sent by the first operating system to the target watchdog module within a current time period; If the acquisition time corresponding to the second dog feeding signal is not within the window period of the current time period, the target watchdog module determines that the state of the first operating system is an abnormal state, and performs exception processing on the first operating system in the abnormal state; If the acquisition time corresponding to the second watchdog signal is within the window period of the current time period, the target watchdog module determines that the state of the first operating system is normal, so that the first operating system in the normal state can send the watchdog source signal to the second operating system through the hardware transmission interface.

8. A monitoring device for an operating system, characterized in that: include: A dog feeding source signal sending module, used for the first operating system to send the dog feeding source signal to the second operating system through a hardware transmission interface; A first dog feeding signal sending module, used for the second operating system to determine a first dog feeding signal according to the received dog feeding source signal, and send the first dog feeding signal to the first operating system through the hardware transmission interface; The monitoring module is used for the first operating system to monitor the state of the second operating system according to the dog feeding source signal and the received first dog feeding signal.

9. A vehicle, characterized in that: include: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product includes program codes, and when the program codes are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images